SSRF — جعل درخواست سمت سرور برای دسترسی به شبکه داخلی

SSRF vulnerabilities allow attackers to induce the server to make HTTP requests to arbitrary destinations, including internal services and cloud metadata endpoints.

## Vulnerability Overview
In SSRF attacks, the attacker causes the server to make requests on their behalf. This is particularly dangerous in cloud environments where the metadata service (169.254.169.254) exposes IAM credentials and instance information.

## Technical Details
- **Vulnerable Component:** Jenkins CLI file read via @/etc/passwd syntax (CVE-2024-23897)
- **Root Cause:** The Jenkins CLI parser processes @ character as a file read directive without authentication
- **Cloud Impact:** AWS metadata at http://169.254.169.254/latest/meta-data/iam/security-credentials/ exposes temporary AWS keys
- **Bypass Techniques:** DNS rebinding, IPv6, URL encoding, redirect chains, alternative IP representations

## Impact Assessment
- Read arbitrary files from the server filesystem
- Access AWS/GCP/Azure instance metadata and IAM credentials
- Pivot to internal services (Redis, Elasticsearch, internal APIs)
- In Jenkins: leads to full RCE via Groovy script execution
- Cloud credential theft enabling full cloud account takeover

## Affected Versions
- Jenkins 2.441 and earlier, LTS 2.426.2 and earlier
- Any application that fetches user-supplied URLs without validation

## Indicators of Compromise
- Requests to 169.254.169.254 in server logs
- Unusual internal network connections from web server